PT-2025-3194 · Zulip · Zulip Server

Alexmv · Published 2025-01-16 · Updated 2025-08-27 · CVE-2024-56136

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Zulip Server versions 7.0 through 9.3

Description The issue concerns an information disclosure attack where an unauthenticated user can determine if an email address is in use by a user on a Zulip server hosting multiple organizations. There are no known workarounds for this issue.

Recommendations For Zulip Server versions 7.0 through 9.3, upgrade to Zulip Server 9.4 or switch to the main branch of Zulip Server to resolve the issue. At the moment, there is no other information about additional mitigation measures.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-56136

GHSA-5XG8-XHFJ-4HM6

Affected Products

Zulip Server

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56136.json · Exploit
• https://github.com/zulip/zulip/commit/c6334a765b1e6d71760e4a3b32ae5b8367f2ed4d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-56136 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56136 · Vendor Advisory
• https://github.com/zulip/zulip/security/advisories/GHSA-5xg8-xhfj-4hm6 · Note
• https://t.me/cveNotify/133633 · Telegram Post
• https://twitter.com/CVEnew/status/1880384788533580228 · Twitter Post
• https://reddit.com/r/selfhosted/comments/1i30p3b/zulip_server_94_security_release · Reddit Post
• https://reddit.com/r/opensource/comments/1i30xam/zulip_server_94_security_release · Reddit Post